This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it and the choices you have. It applies to Spoofey users, to people who visit our websites, and to people who are not users but whose information we process because a call, message or lookup involves them.
This Privacy Policy explains how Machport LLC, a New Mexico limited liability company doing business as Spoofey (“Spoofey”, “we”, “us”), with its principal address at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA, collects, uses, discloses and retains personal information in connection with our websites, applications, APIs, calling, messaging, number and lookup services (the “Service”). Terms defined in our Terms of Service have the same meaning here.
Privacy questions and requests go to privacy@spoofey.com.
| Information | When we collect it |
|---|---|
| Username, email address and password (stored only as a salted hash) | When you sign up |
| Country, time zone, profile details, avatar and profile visibility setting | Account settings |
| Registered Number: your own telephone number, which we call to connect you | Before you can place calls, verified by an automated call or a code sent to that number |
| Identity documents, proof of address, source of funds, business registration, or authorisation from a number’s subscriber | Only on escalated verification, for example after a risk flag, high spend, a payment dispute, a complaint or a legal enquiry (Terms, section 3) |
| Business details: business name, address, contact details, logo, team members’ names and emails, opening hours, call flows and greetings | When you create or manage a business account |
| Instructions you write for an AI call (the “brief”), the voice you choose, and settings for AI features | When you use AI features |
| Text messages you send through the Service, and the numbers you send them to | When you use messaging features |
| Direct messages, comments, community reports about numbers, and other content you post | Community features and Numberprint |
| Correspondence with support, abuse reports, opt-out requests and feedback | Email, phone and in-product support |
Spoofey is a callback bridge: we call your Registered Number first, then dial the destination and connect the two. Each call therefore produces records for two legs.
| Leg | What we record |
|---|---|
| First leg, to you | Your Registered Number, the time we dialled it, whether and when you answered, and the duration |
| Second leg, to the destination | The destination number, the caller ID presented, timestamps, duration, outcome, and any failure or block reason |
| Both | Route and carrier, credits used, and the account and IP address that requested the call |
Because the first leg always reaches you, a verified number belonging to you is attached to every call you place.
We may record and monitor either leg of any call, including all audio carried on it, for the purposes set out in section 12 of the Terms. For AI calls and AI-assisted features we also process the audio of the call, machine-generated transcripts and summaries, the brief you wrote, and classifications or risk signals derived from them. Business accounts may choose to record calls and keep voicemail, which we store on the business’s behalf.
When a user calls, messages or looks up a telephone number, we process information about the person on the other end: their number, the time and duration of the call, any audio, voicemail or message content, and any transcript. Numberprint also displays information about telephone numbers drawn from carriers, public sources, data providers and community reports, such as carrier, line type, approximate region, caller name and spam reports. If you want to ask about information we hold about your number, or object to it, contact privacy@spoofey.com.
Payments are processed by third-party providers, including Stripe for cards. We receive the amount, currency, status, time, a transaction reference and, for saved cards, the card brand, last four digits and expiry date. We do not receive or store full card numbers. For cryptocurrency payments we receive the asset and the on-chain transaction identifier, which anyone may be able to link to a wallet and its history.
We receive information from called parties, number subscribers, carriers, industry traceback groups, regulators, law-enforcement bodies, payment processors, fraud-prevention, sanctions-screening and identity-verification providers, and phone-number data providers.
We use personal information for the purposes below. Where the EU or UK GDPR or a similar law applies, we rely on the legal basis shown.
| Purpose | Legal basis |
|---|---|
| Creating and running your account; placing your calls and messages; providing AI, business, number and lookup features; taking payment; providing support | Performance of a contract |
| Operating the anti-fraud and risk system and the high-risk number blacklist; detecting and preventing fraud, abuse, harassment and misuse | Legitimate interests in protecting the public, our carriers and our business |
| Identity and entitlement verification; sanctions and restricted-party screening | Legal obligation, and legitimate interests |
| Recording and monitoring calls; keeping call records; responding to traceback groups, carriers, regulators, courts and law enforcement | Legal obligation, and legitimate interests |
| Operating Numberprint and community reports | Legitimate interests in helping people identify unwanted and fraudulent calls |
| Security, logging, monitoring, backup and incident response | Legitimate interests, and legal obligation |
| Maintaining and improving the Service, including call quality and aggregate analytics | Legitimate interests |
| Marketing email | Consent, or legitimate interests where the law allows. You can unsubscribe at any time |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. Because a caller-ID service can be misused to defraud or harass people, we consider detailed logging, call recording and active risk screening necessary and proportionate.
Our risk system automatically evaluates accounts, payments, calls and messages. It can decline a call, apply limits, hold a payment, or refer an account for review, and these decisions can significantly affect you.
We carry out this processing because it is necessary to perform our contract with you, to comply with our legal obligations, and to prevent fraud. Where the law gives you the right, you may ask for human review of a decision, give your point of view and contest it by writing to privacy@spoofey.com. We do not disclose the specific signals, weights or thresholds the system uses, as that would allow it to be circumvented.
We keep personal information for as long as we need it for the purposes in section 3, using the periods below. When we no longer need it, we delete or anonymise it.
| Category | Retention |
|---|---|
| Profile details (avatar, bio, display settings) | Until you change them or close your account |
| Account identifiers, Registered Number and verification records | For the life of the account and as long afterwards as the call records they are attached to are kept |
| Call detail records and call recordings | At least 24 months from the call, as traceback and law-enforcement requests often arrive months later, and longer where the account remains open, a dispute or investigation is ongoing, or the law requires it |
| Transcripts used for fraud and risk screening | 30 days |
| AI call briefs, transcripts and summaries shown in your account | Until you delete them or close your account, subject to the call-record period above |
| Business voicemail and recordings | As set by the business account, between 1 and 365 days (30 days by default) |
| Messages | Until deleted by you or by us, plus our backup cycle |
| Identity documents, where escalation required them | 5 years after account closure, or as required by anti-money-laundering law |
| Payment and transaction records | 7 years, for tax and accounting purposes |
| Risk, abuse and enforcement records, including records of terminated accounts | For as long as needed to prevent banned users from returning and to defend legal claims |
| Server and security logs | Generally 90 days |
We may keep information longer where it is subject to a preservation request, legal hold or investigation, or an actual or anticipated legal claim.
Depending on where you live, you may have the right to know about and access the personal information we hold about you; to correct it; to delete it; to receive it in a portable format; to restrict or object to its processing; to withdraw consent; and to complain to a data-protection authority.
To make a request, email privacy@spoofey.com from the address on your account. We will verify your identity before acting, and may ask for more information to do so. We respond within the period the applicable law requires.
Some information cannot be deleted on request. This includes call records, recordings, risk records and verification documents while we are required to keep them, while they are needed to establish or defend a legal claim, or where deleting them would prevent us from meeting obligations to law enforcement, regulators or carriers. Where we refuse a request, we will tell you why.
This section applies to residents of California and of other U.S. states with comprehensive consumer privacy laws, and supplements the rest of this Policy. It also serves as our notice at collection under the California Consumer Privacy Act, as amended (the “CCPA”).
In the past 12 months we have collected the following categories of personal information, from the sources described in section 2, for the purposes described in section 3, and disclosed them for business purposes to the categories of recipients in section 5:
We use and disclose sensitive personal information only for purposes the CCPA permits without a right to limit, such as providing the Service, security and fraud prevention, and complying with law. We do not use it to infer characteristics about you. Retention periods are in section 6.
We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. We honour Global Privacy Control signals as a request to opt out of sale and sharing for the browser that sends them.
Subject to exceptions in the law, you may request to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of recipients; to delete it; to correct it; and to opt out of sale, sharing and certain profiling. We will not discriminate against you for exercising these rights.
Authorised agents. You may use an authorised agent to make a request. We may ask the agent for proof of your signed permission and ask you to verify your identity directly with us.
Appeals. If we decline your request, you may appeal by replying to our decision or by emailing privacy@spoofey.com with the subject “Appeal”. We will respond within the period your state’s law requires. If you are not satisfied, you may contact your state attorney general.
We are based in the United States and our infrastructure is located in the United States and Canada. Your information may be processed there and in any country where our service providers or a carrier in the call path operate. Calls and messages are routed across borders, and the destination and caller ID are necessarily disclosed to carriers in those countries.
Where we transfer personal information from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, together with supplementary measures where needed. You may request a copy of the relevant safeguards from privacy@spoofey.com.
We protect personal information with encryption in transit, salted password hashing, access controls and least-privilege administration, audit logging, rate limiting, and separation of verification documents from general account data. Access to recordings and transcripts is limited to personnel who need it for the purposes in this Policy.
No system is completely secure, and we cannot guarantee the security of information you send us. You are responsible for keeping your password and API keys confidential. If a breach occurs that the law requires us to report, we will notify the relevant authorities and affected individuals within the time the law sets.
The Service is not directed to children, and only people aged 18 or over may open an account. We do not knowingly collect personal information from children under 13 or, where local law sets a higher age, under that age. If you believe a child has given us personal information, contact privacy@spoofey.com and we will delete it and close the account.
We may update this Policy. The effective date at the top shows when it last changed. We will notify you of material changes by email or in-product notice where reasonably practicable, and where the law requires your consent to a change, we will ask for it.
Privacy questions and requests: privacy@spoofey.com
Abuse reports and unauthorised use of your number: abuse@spoofey.com
Law-enforcement and legal requests: legal@spoofey.com
Post: Machport LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
Questions about this document? Write to legal@spoofey.com. See also the Terms of Service.